The Agent Skills Directory

[DATA_EXPOSURE]: The skill accesses highly sensitive personal data stored in macOS system databases and applications. Specifically, it targets ~/Library/Messages/chat.db for reading iMessage and SMS history, which requires Full Disk Access. It also accesses Contacts, Calendar, Notes, and Mail via specialized bridge binaries at ~/.claude/.- [PRIVILEGE_ESCALATION]: The tmux-bridge documentation describes interactive terminal control and explicitly mentions using the write command for 'Running sudo commands' and 'system administration tasks', which could allow an agent to gain administrative access to the host system.- [INDIRECT_PROMPT_INJECTION]: The skill facilitates the ingestion of data from uncontrolled external sources into the agent's context. 1. Ingestion points: mail-bridge (inbox/read), messages-bridge (chats/read), notes-bridge (notes/read), and tmux-bridge (pane content). 2. Boundary markers: None identified; instructions do not specify delimiters to isolate untrusted data. 3. Capability inventory: Extensive write capabilities including sending emails (mail-bridge send), sending messages (messages-bridge send), and terminal keystroke injection (tmux-bridge write). 4. Sanitization: No sanitization methods are described for handling external content before it enters the agent's context.- [COMMAND_EXECUTION]: The skill relies on and executes custom CLI binaries located in the hidden ~/.claude/ directory to interface with macOS applications.

apple-bridges